WordPress blowed up real good

I think I now understand how Windows partisans feel when people like me get all smug about how viruses just seem to like that particular operating system.

Because I'm in a similar sitch at the moment with WordPress. As you may have heard, all hell broke loose this weekend as a worm had its way with WordPress installations that were neither updated to the latest version nor hardened. All of my sites fared well, but not everyone was so lucky, from uber-blogger Robert Scoble to countless tiny sites scattered across the net.

Andy Inhatko has an informative and, well, entertaining wrap-up of what it took for him to get back to normal.

John Gruber casts a much more gimlety-eye at the whole mess, saying, finally, that WP is not for absentee-admins. I'm with him on that.

As with OS X updates, I'm very bullish on WP updates, especially of the security-enhancement variety, as 2.8.3 and 2.8.4 were. I also believe that, if you really, really care about the sites you build (or, especially, build for people who hand you a paycheck on a regular basis), you should go even further in ensuring security by:

• Nuking the "admin" named account as your second order of business, after creating a new admin-level account with a non-obvious name.


• Requiring long, difficult passwords from all users above "contributor" level.


• Renaming your database tables from the standard wp_


• Putting server-level access rules in front of your admin dashboard.


• Backing up your databases regularly. There's even a simple plugin that will do that for you at a set interval.

Is all of this worth what you get from a self-hosted WordPress site? I still say yes, but if you're not willing to take the minimal steps to guarantee the security of your site, then you will probably be happier in the long run with a hosted wordpress.com site or any of the many alternatives out there.

Kaboom!

Hah! It figures that the moment I decide to start writing about WordPress, my fancy-schmancy custom theme decides that it's going to explode on the single posts.

There's work to be done...

EDIT TO ADD: Looks like I've reverted to the stock theme. Marina hated that picture of me anyway. So enjoy the stock imagery for a few days until I have an hour to throw at fixing the theme.

WordPress: It's a great CMS

So, WordPress.

Depending on the day, it's the smile on my face or the knot on my brow. It's probably the simplest thing I've ever monkeyed with behind the curtain and, yet, it's insanely complex.

According to those who know, it's a lousy content management system. And yet, I have to disagree. It's got some limitations, to be sure, but I've found it to be remarkably malleable, bending itself to many of the tasks I've thrown at it.

But I'm getting ahead of myself. Because just a few months ago, I was very much a WordPress n00b, thinking that "customizing" meant ticking off the options on the expensive (and! virally! marketed!) theme I applied to this blog a year ago.

That was before I grew to understand the magic in a publishing platform for which you merely had to type into Google "Whatever crazy feature you'd like your site to have" and "WordPress plugin."

But again, I'm rushing ahead. First comes the framework.

As Andy Ihnatko said the other day:

Forget about finding a Wordpress theme that looks like it’s just a few tweaks and styles away from what I want. Instead, I’ll start with an utterly blank theme with every piece of WP infrastructure I’ll need, and use it as the starting point.

So here’s where I am right now: I’ve downloaded and installed the K2 theme. There are a couple of (old) tutorials on customizing it, and I’ll prolly be dipping deep into that well.

...

What’s the worst that can happen? The worst that can happen is that I learn something.

That's been my mantra as I try to push and prod WordPress into a CMS: What's the worst that can happen? Is trial-and-error the best way to teach myself PHP? Probably not. But as long as I pay close attention and make a copy of my files as I go along, the worst thing is, as Andy says, I pick up a little more knowledge along with the bruises.

So, sporadically, I'll be sharing what I've found and, more often than not, begging for help out of a bind.

But know this: I believe WordPress is a great CMS.